IPE Engwicht listed on Inc Ransom leak site following claimed data breach

• Ransomware group: Inc Ransom
• Country: Germany
• Sector: Manufacturing
• Announcement date: November 23, 2024

Inc Ransom claims data exfiltration from IPE Engwicht

The threat actor known as Inc Ransom has listed the German manufacturing firm IPE Engwicht on its dedicated leak site. According to the group's announcement, they have successfully gained access to the organization's network and claim to have exfiltrated various files from the company's systems. This listing appeared on the group's platform on November 23, 2024, marking a new instance of targeted activity against the industrial sector.

The announcement made by the threat actor includes information regarding the business activities of the company. To support their claims of a successful breach, the group has provided screenshots that display various file directory structures found within the victim's environment. While the group has claimed to have obtained various files, they have not provided specific details regarding the total volume of data stolen or the specific amount of files accessed.

Details of the claimed data breach

The exact nature of the exfiltrated data has not been explicitly stated by the threat actor. However, based on the screenshots provided in the leak site listing, the captured images show file directory structures that appear to be related to technical project files, EPLAN data, and engineering documentation. The presence of these directories suggests that the breach may involve sensitive technical information used in the company's core operations.

The specific types of data identified in the screenshots include:

• Technical project files
• Engineering documentation

It is important to note that the group has not specified the exact contents of the files or the total size of the data stolen. The information currently available is limited to the directory structures and the types of files visible in the provided evidence.

About IPE Engwicht

IPE Engwicht is a Germany-based engineering and manufacturing company. The organization specializes in several critical industrial areas, including industrial automation, custom machine construction, and metal processing. As a player in the manufacturing and engineering sector, the company's operations rely heavily on technical documentation and specialized engineering data to maintain its production and design processes.

Analysis and potential risks

Given that the organization operates in the manufacturing and automation sector, the leaked data may pose significant risks to intellectual property and trade secrets. The nature of the files shown in the screenshots—such as engineering documentation and technical project files—indicates that the breach could impact the company's competitive advantage and proprietary designs. Furthermore, because the organization is based in Germany, a potential data breach could lead to legal sanctions and notification obligations under the General Data Protection Regulation (GDPR).

The use of double-extortion tactics by the Inc Ransom group suggests that secondary risks may increase. Double extortion is a common ransomware tactic where attackers not only encrypt a victim's data to disrupt operations but also steal sensitive information to threaten the victim with its public release or sale on the dark web. This tactic increases the pressure on organizations to comply with ransom demands to prevent reputational damage or the loss of intellectual property.

In addition to the risks to operational continuity, other secondary risks may emerge. For example, the theft of technical data or contact information could lead to targeted phishing attacks against supply chain partners. When a manufacturer is compromised, its partners and clients may become targets for social engineering or secondary attacks attempting to exploit the trust established through the manufacturing relationship. Organizations in this sector often prioritize protecting their technical blueprints and automation processes to prevent industrial espionage and maintain their market position.